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DETAILED ACTION 
Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form 
the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

1. Claims 1 1, 22 and 36 are rejected are rejected under U.S.C. 102(b) as anticipated by 
OraCon (Oracle8 Concepts, Release 8.0, Volumes 1 and 2, December 1997, Oracle 
Corporation). 

As per Claims 1 1 , 22 and 36, OraCon teaches the following: 
"information relating to an entry in a database having a plurality of data items related to 
data subjects" at Pages 1-7 to 1-10 and Figs. 1-1 and 1-2 by showing a database 
instance consisting of a plurality of users and applications (Page 1-8, specifically); 
"the information including an indication of when the data related to a given data subject 
was last verified as correct by that data subject" at Pages 27-2 and 27-3 where 
database objects are audited and audit trails, stored into table, "comprising the step of: 
updating the information automatically when the data subject to whom the data item 
relates views the data item" at Pages 27-2 and 27-3 where the writing of audit trail table 
is done automatically by the database management system. 

Claim Rejections - 35 USC § 103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 
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(a) A patent may not be obtained although the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

2. Claims 1-4, 12-15, 23-27 and 33 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Choy (U.S. Patent 6,581,060) and in view of Lessard (U.S. 
Publication 2002/0188774). 

As per Claims 1, 12 and 23, Choy teaches "data items ... including consensus related 
information" at Figs. 5-6, col. 3, lines 47-48 and col. 6, lines 20-31 where access 
authorizing information is combined with the data item by joining the access 
authorization table with information table; and "passing the data items to a user for 
viewing" at Fig. 6, elements 64-68 and col. 6, lines 44-53 where the information being 
reviewed is the joined access authorization and information tables. 

Choy does not specifically teach "attaching a wrapper to at least some of the data 
items" although Choy teaches combination of records by joining tables. 

However, Lessard teaches wrapping data items at Fig. 6, elements 604-606 and 
Page 6, [0059] where a table contains external data and wrapping data. 

It would have been obvious to one having ordinary skill in the art at the time of the 
applicant's invention was made to combine Lessard's reference into Choy's by wrapping 
data to the end table records because both references are directed to combine data to 
form a new record, and the combined reference would have provided users of Choy's 
system with flexibility of utilizing and wrapping data together by selecting fields of 
specifying characteristics, such as consensus and authorization information as desired 
by Choy's for wrapping to the data items. 
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As per Claims 2 and 13, Choy teaches "wrapper includes an indication of whether the 
data items can be displayed to other users" at col. 2, lines 33-37 and col. 7, lines 46-48 
where multiple rows of data can be bound to respective multiple access control rules, 
including the read authorization of data. 

As per Claims 3, 14 and 26, Choy teaches "the indication comprises a consent flag" 
at Fig. 2, element 40 and col. 5, lines 45-55 where ACL attribute can be evaluated to 
allow or disallow for serving as a consensus key. 

As per Claims 4, 15 and 27, Choy teaches "the consent flag has a first state in which 
the data item can be viewed by other users, a second state in which the data item 
cannot be viewed by other users" at Fig. 2, element 40 and col. 5, lines 45-55 where 
ACL attribute can be evaluated to allow or disallow for serving as a consensus key, and 
"a default state in which the data item can be viewed by other users only if it is not 
defined as sensitive data" at col. 5, lines 28-30, 36-38 and 51-55 by suggesting the 
functionality of ACL attribute (consisting of privilege, user and condition attributes) for 
access protection can be extended, including a default third state. 

As per Claim 24, Choy teaches "database is located at a database server" at Fig. 1 
where the server computer (element 28) having a relational database (element 24). 

Choy does not specifically teach "store is located at a consensus server". 

However, Lessard teaches a consensus server having a store for storing wrappers at 
Fig. 1 where sever computer (element 102) serving as the consensus server having a 
store (element 126) to be utilized as the wrapper store. 

It would have been obvious to one having ordinary skill in the art at the time of the 
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applicant's invention was made to combine Lessard's reference into Choy's by 
separating database server from the consensus server because the two references are 
directed to data access control and validity and the combined reference would have 
separated database management server from application server. The separation of the 
servers would have provided flexibility of database and application maintenance. 
Further more, the separation would have provided scalability for system configuration. 

As per Claim 25, Choy teaches "a rules table for applying flag rules and consensus 
rules to data items and system users respectively" at Fig. 5, where access authorization 
table is the rules table whose condition, operation and ACL components are combined 
with user and user group components to provide flag rules and consensus rules to 
users and system users respectively. 

As per Claim 33, Lessard further teaches "a web server for providing access to users 
across the Internet" at Page 3, [0030] by showing client includes internet browser 
program. 

3. Claims 5-7, 9-10, 16-18, 20-21 , 28-29, 31-32 and 34-35 are rejected under 35 U.S.C. 
103(a) as being unpatentable over Choy (U.S. Patent 6,581 ,060) in view of Lessard 
(U.S. Publication 2002/0188774), as applied to Claims 1-4, 12-15, 23-27 and 33, and 
further in view of OraCon (Oracle8 Concepts, Release 8.0, Volumes 1 and 2, December 
1997, Oracle Corporation). 

As per Claims 5, 16 and 28, the Lessard-Choy combined reference teaches wrapping 
data as described in Item 2. 
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The Lessard-Choy combined reference does not specifically teach "the wrapper 
includes an indication of when the data item was last correct, the method further 
comprising the steps of: automatically updating the indication of when the data was last 
correct when the user to whom the data item relates views the data item", although the 
combined reference teaches wrapping data items with access control information and 
updating access control information (Choy, col. 6, lines 1-10). 

However, OraCon teaches using background processes to automatically trace 
database error and writing into trace log at Pages 7-14 and 7-15, and audit process to 
automatically audit database objects changes at Pages 27-2 to 27-12. Based on the 
traced error log, data was correct before when the error was traced. 

It would have been obvious to one having ordinary skill in the art at the time of the 
applicant's invention was made to combine OraCon's reference with Lessard and 
Choy's by using background and audit processes to trace data errors and audit data 
changes automatically because all three references are directed to data access control 
and data validity. The combined reference provides teaching of data structure for data 
wrapping and access control where the data structure would have been utilized to 
record data errors and changes information. The combination of the three references 
would have been able to provide a sole integrated source of information for data access 
control and data integrity. 

As per Claims 6, 17 and 29, OraCon further teaches "includes an indication of when 
and by whom the data item was changed" at Page 27-3 by using data audit trail to 
indicate when and by whom the data item was changed. 
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As per Claims 7, 18 and 32, OraCon further teaches "comprising the steps of 
updating an audit log when the data item or any data in the wrapper relating to the data 
item is changed" at Page 27-3 where audit trail is stored into a database table. 

As per Claims 9, 20 and 31 , OraCon further teaches "a flag is set for each user 
indicating whether they have accepted a current rule set governing access to the 
database, and access to the database is denied if the rule set is not accepted" at Pages 

25- 4 and 25-5 by using authentication as a rule set for governing user access to the 
database and using the times of user login failure to lock the user's account. 

As per Claims 10, 21 and 35, OraCon further teaches "automatically notifying an 
administrator if a user makes a change to a data item related to the user" at Page 25-4 
by storing auditing information of database objects into a table serving as the 
administration's notice on user's access to objects and object changes. 

As per Claim 34, OraCon further teaches "protected database according to claim 23, 
wherein the users comprise a data controller and a plurality of data subjects" at Page 

26- 2 and 26-3 where users granted with database system privilege is the data controller 
whose schema consists of data subjects. 

4. Claims 8, 19 and 30 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Choy (U.S. Patent 6,581 ,060) in view of Lessard (U.S. Publication 2002/0188774), as 
applied to Claims 1-4, 12-15, 23-27 and 33, and further in view of Baumeister et al. 
(U.S. Publication 2002/0042910, hereafter "Baumeister"). 

As per Claims 8, 19 and 30, the Lessard-Choy combined reference teaches wrapping 
data as described in Item 2. 
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The Lessard-Choy combined reference does not specifically teach "calculating a 
value of the checksum when a data item is requested from the database". 

However, Baumeister teaches at Page 2, [0018] by providing checksum error 
information when data is requested. 

It would have been obvious to one having ordinary skill in the art at the time of the 
applicant's invention was made to combine Baumeister's reference with Lessard-C hoy's 
by including checksum error when the wrapped data is requested because all three 
references are directed to data access control and data validity and the combined 
reference would have further guaranteed data integrity. 

Baumeister further teaches "comparing the calculated value with the checksum in the 
wrapper" at Page 2, [0018]; and "forwarding the data item to the user only if the 
calculated checksum agrees with the checksum in the wrapper" at Page 2, [0019]. 
5. Claims 37-38 are rejected under 35 U.S.C. 103(a) as being unpatentable over Choy 
(U.S. Patent 6,581 ,060) in view of Lessard (U.S. Publication 2002/0188774), and further 
in view of OraCon (Oracle8 Concepts, Release 8.0, Volumes 1 and 2, December 1997, 
Oracle Corporation). 

As per Claims 37 and 38, Choy teaches "data items ... including consensus related 
information" at Figs. 5-6, col. 3, lines 47-48 and col. 6, lines 20-31 where access 
authorizing information is combined with the data item by joining the access 
authorization table with information table; and "passing the data items to a user for 
viewing" at Fig. 6, elements 64-68 and col. 6, lines 44-53 where the information being 
reviewed is the joined access authorization and information tables. 
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Choy does not specifically teach "attaching a wrapper to at least some of the data 
items" although Choy teaches combination of records by joining the tables. 

However, Lessard teaches wrapping data items at Fig. 6, elements 604-606 and 
Page 6, [0059] where a table contains external data and wrapping data. 

It would have been obvious to one having ordinary skill in the art at the time of the 
applicant's invention was made to combine Lessard's reference into Choy's by wrapping 
data to the end table records because both references are directed to combine data to 
form a new record, and the combined reference would have provided users of Choy's 
system with flexibility of utilizing and wrapping data together by selecting fields of 
specifying characteristics, such as consensus and authorization information as desired 
by Choy's for wrapping to the data items. 

The combined Lessard-Choy reference does not specifically teach "the wrapper 
includes an indication of when the data item was last correct, the method further 
comprising the steps of: automatically updating the indication of when the data was last 
correct when the user to whom the data item relates views the data item", although the 
combined reference teaches wrapping data items with access control information and 
updating access control information (Choy, col. 6, lines 1-10). 

However, OraCon teaches using background processes to automatically trace 
database error and writing into trace log at Pages 7-14 and 7-15, and audit process to 
automatically audit database objects changes at Pages 27-2 to 27-12. Based on the 
traced error log, data was correct before when the error was traced. 
It would have been obvious to one having ordinary skill in the art at the time of the 
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applicant's invention was made to combine OraCon's reference with Lessard-Choy's by 
using background and audit processes to trace data errors and audit data changes 
automatically because all three references are directed to data access control and data 
validity. The combined reference provides teaching of data structure for data wrapping 
and access control where the data structure would have been utilized to record data 
errors and changes information. The combination of the three references would have 
been able to provide a sole integrated source of information for data access control and 
data integrity. 

6. Claims 39-40 are rejected under 35 U.S.C. 103(a) as being unpatentable over Choy 
(U.S. Patent 6,581 ,060) in view of Lessard (U.S. Publication 2002/0188774), and further 
in view of Baumeister et al. (U.S. Publication 2002/0042910, hereafter "Baumeister"). 

As per Claims 39 and 40, Choy teaches "a database server having a database for 
storing data items relating to data subjects" at Fig. 1 where the server computer 
(element 28) having a relational database (element 24). 

Choy does not specifically teach "attaching a wrapper to at least some of the data 
items" although Choy teaches combination of records by joining the tables. 

However, Lessard teaches wrapping data items at Fig. 6, elements 604-606 and 
Page 6, [0059] where a table contains external data and wrapping data. 

It would have been obvious to one having ordinary skill in the art at the time of the 
applicant's invention was made to combine Lessard's reference into Choy's by wrapping 
data to the end table records because both references are directed to combine data to 
form a new record, and the combined reference would have provided users of Choy's 
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system with flexibility of utilizing and wrapping data together by selecting fields of 
specifying characteristics, such as consensus and authorization information as desired 
by Choy's for wrapping to the data items. 

Lessard further teaches "a consensus server having a store for storing wrappers" at 
Fig. 1 where sever computer (element 102) serving as the consensus server having a 
store (element 126) to be utilized as the wrapper store. 

The Lessard-Choy combined reference does not specifically teach "a checksum field 
which stores a checksum based on the content of said wrapper fields". 

However, Baumeister teaches at Page 2, [0018] by providing checksum error 
information when data is requested. 

It would have been obvious to one having ordinary skill in the art at the time of the 
applicant's invention was made to combine Baumeister's reference with Lessard-Choy's 
by including checksum error when the wrapped data is requested because all three 
references are directed to data access control and data validity and the combined 
reference would have further guaranteed data integrity. 

Baumeister further teaches "consensus server further comprises a checksum 
generator for generating a fresh checksum when a data item is requested by said 
application server, for checking said fresh checksum with said checksum in said 
wrapper checksum field and for passing said data item to said application server only if 
said fresh checksum corresponds to said checksum in said wrapper" at Page 2, [0018] 
and Page 2, [0019]. 

It would have been obvious to one having ordinary skill in the art at the time of the 
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applicant's invention was made to combine Baumeister's reference with Lessard and 
Choy's by including checksum error when the wrapped data is requested because all 
three references are directed to data access control and data validity and the combined 
reference would have further guaranteed data integrity. 

Conclusions 

7. The prior art made of record 

A. U.S. Patent 6,581,060 

B. U.S. Publication 2002/0188774 

C. U.S. Publication 2002/0042910 

U. Oracle8 Concepts, Release 8.0, Volumes 1 and 2, December 1997, 
Oracle Corporation 

The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

D. U.S. Patent 6,510,513 

E. U.S. Publication 2001/0019614 

F. U.S. Patent 6,578,037 

G. U.S. Patent 6,654,745 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Kuen S Lu whose telephone number is 703-305-4894. 
The examiner can normally be reached on 8 AM to 5 PM, Monday through Friday. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Breene can be reached on 703-305-9790. The fax phone number for 
the organization where this application or proceeding is assigned is (703) 872-9306. 
Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is 703-305-3900. 

KL 

Patent Examiner 
April 30, 2004 
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